Trouble with "process check"

Gilali · Post by **Gilali** » Wed Mar 24, 2010 7:27 am

Hi,

I have a little trouble that I can't explain.

I have 2 similars phone server(windows 2003) on which I want to check some processes.

This servers are in same domain with same subnet and gateway.

On one, I can do any process tests that I want, but, on second server, when I try to do this, I have a message "Warning : Cannot retrieve process list on server2"

...... but when I want to check services, there is no problem!!!

Remote registry service and RPC are up and running on both, and perfProc.DLL is on system. That's exactly the same configuration with same services which are in same states on both. There are no firewall inside our organization between servers and workstations, I have not installed antivirus on it.

Last but not the least, when I'm using WMIEXPLORER, Win32_Process shows me all processes on server2. !!!????

Anyone has an idea ????

Config : hostmonitor 8.54, started as a service with admin account, and into "connect as" I have an admin account.

Thanks for your help.

Just a little precision, this 2 servers are in fact 2 VM.

Regards,[/b]

KS-Soft · Post by **KS-Soft** » Wed Mar 24, 2010 9:42 am

These 3 test methods (Service, Process and WMI) use 3 different techniques.
I would recommend to setup CPU Usage test method for the same server and check error description that will be displayed in Reply field of the test.
CPU Usage test use the same Performance Counter technique as Process test method.

Regards
Alex

Gilali · Post by **Gilali** » Thu Mar 25, 2010 7:04 am

Thanks for your reply, Alex.

I try a cpu usage test like you suggest, and, you're right, I have a error on Server2:
Unable to locate the "Processor" performance object.

I find this topic about a similar trouble :
RMA: 301 on CPU and Process tests
http://www.ks-soft.net/cgi-bin/phpBB/vi ... 0604ea204f

I read it, try it without success and finally, like you suggest it,
I restarted server, tests work well for 2 hours(I can retrieve process list), and now, I have the same trouble, tests are bad because I have no access to the process list from server2

??? #?@#!!!!!!!

When I lost connection, I see this in log :

First

Event Type: Information
Event Source: LoadPerf
Event Category: None
Event ID: 1001
Date: 25/03/2010
Time: 15:52:08
User: N/A
Computer: XXXXXXXXXXXXX
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:
0000: ca 0f 00 00 cb 0f 00 00 Ê..Ë..
0008: 54 05 00 00 T...

Second

Event Type: Information
Event Source: LoadPerf
Event Category: None
Event ID: 1000
Date: 25/03/2010
Time: 15:52:08
User: N/A
Computer: XXXXXXXXXXX
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data contains the new index values assigned to this service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:
0000: cc 0f 00 00 f6 0f 00 00 Ì..ö..
0008: cd 0f 00 00 f7 0f 00 00 Í..÷..

But when I look log of server1 where tests are goods, I have this logs too.!!!!!!

Did you have this kind of trouble ?

Gilali

KS-Soft · Post by **KS-Soft** » Thu Mar 25, 2010 11:10 am

No, we do not have such kind of trouble.
However we know Windows Performance Counters technology sometimes work unreliable. That's why we have implemented WMI test method.
http://www.ks-soft.net/hostmon.eng/mfra ... ts.htm#wmi

There is Win32_Process class that allows you to check parameters of some specific process.

Regards
Alex

Gilali · Post by **Gilali** » Mon Mar 29, 2010 2:14 am

Hi Alex,

As process test not working properly, I try to use WMI tes to verify some process running on target machine.

When I try it, with this request " select caption from Win32_Process where description ="qorasrv.exe ", I have this message : " Acces is denied"!!!!! I don't understand that because my tests are made with a domain admin account which is defined on server too.

But when I create this kind of tests(WMI), I can easily connect to remote server with admin account and password, I can write a request which is send me back a good response, but when I try to automatize this, it doesn't work!!!!!

I remark something, I had a process test that's working good with one server(since HostMonitor 7.52), and today for some reason, we must reboot it, and when it restarted, I had the same trouble and message!!!

I check log a server, and see that my trouble appears after this :

Event Type: Information
Event Source: LoadPerf
Event Category: None
Event ID: 1001
Date: 29/03/2010
Time: 9:50:28
User: N/A
Computer: xxxxxxxxxxxx
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:
0000: 34 10 00 00 35 10 00 00 4..5..
0008: 54 05 00 00 T...

Event Type: Information
Event Source: LoadPerf
Event Category: None
Event ID: 1000
Date: 29/03/2010
Time: 9:50:28
User: N/A
Computer: xxxxxxxxxxx
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data contains the new index values assigned to this service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:
0000: 36 10 00 00 3a 10 00 00 6..:..
0008: 37 10 00 00 3b 10 00 00 7..;..

It's exactly the same symptoms like I reported last week.

Before I install this Host Monitor version (8.54) I'll never has this problem with loadperf on this system(I check my logs on the server, and this log shows me that this events happening since server is running).

Is it normal that I have this log on Host Monitor Server ??? It appears since I decide to run Host Mon as a service!!

Event Type: Warning
Event Source: HostMonService
Event Category: None
Event ID: 1002
Date: 11/05/2009
Time: 8:52:11
User: N/A
Computer: HOSTMONITORSERVER
Description:
The description for Event ID ( 1002 ) in Source ( HostMonService ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Cannot logon as user "syadnaac". Logon failure: unknown user name or bad password..

Is there something new with this version ?

I begin to loose my mind!!!!!!!!

If someone has an idea .......

I will appreciate

.

Thanks,

Gilali

KS-Soft · Post by **KS-Soft** » Mon Mar 29, 2010 10:35 am

When I try it, with this request " select caption from Win32_Process where description ="qorasrv.exe ", I have this message : " Acces is denied"!!!!! I don't understand that because my tests are made with a domain admin account which is defined on server too.
But when I create this kind of tests(WMI), I can easily connect to remote server with admin account and password, I can write a request which is send me back a good response, but when I try to automatize this, it doesn't work!!!!!

Sorry, I do not understand you. You said "when I create this kind of tests(WMI), I can easily connect". I assume this means test works fine?
Then what do you mean when you say "when I try to automatize this, it doesn't work"?
Do you mean HostMonitor can perform the test while WMI Explorer cannot execute query? Do you setup test and start WMI Explorer directly from HostMonitor or you are using Remote Control Console?

Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries

HostMonitor does not perform such operations. You should find some 3rd party software that is installed on your system...

Before I install this Host Monitor version (8.54) I'll never has this problem with loadperf on this system(I check my logs on the server, and this log shows me that this events happening since server is running).

I think you installed something else at the same time. We have not changed code used for CPU Usage, Process and Performance Counter test methods for a long time.

Regards
Alex

Gilali · Post by **Gilali** » Tue Mar 30, 2010 6:28 am

Hi Alex,

First of all, thanks for your help.

Second, I found where trouble came from

I think that performance counters are corrupted by third application.

I try to explain what I did to resolve this kind of error :

First of all, download this Microsoft Utility here :

http://download.microsoft.com/download/ ... _setup.exe

Install it(by default, it will be installed in C:\Program Files\Resource Kit) and launch the executable (exctrlst.exe).

Introduce machine name where you have this kind of trouble.

Sort by Service

Search in list, PerProc, click on it, then uncheck Performance Counter Enabled
Do the same thing with PerfOS.
Now you have 2 Unchecked Performance counters.

enable again this 2 counters(by rechecking it) and then, stop and start the remote registry service on server on which you have trouble.

Test your process or cpu usage test, and you'll see that it works well

It's works too when you only do the restart of remote registry service on server, but, by this manipulation, we reinitialize too Performance counter value.

I hope that this can help someone who will have this kind of trouble

Regards,

Gilali

KS-Soft · Post by **KS-Soft** » Tue Mar 30, 2010 10:15 am

Great

Thank you for the notice

Regards
Alex